24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T480,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Dropper Sample 9a44ef502f2a… — Score 67/100 — Hybrid Analysis","description":"Malicious verdict for sample 9a44ef502f2a…. Malware family: Trojan.Dropper. Threat score 67/100. 18/28 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0","keywords":["Malicious","Trojan.Dropper","malware analysis","sandbox report","threat intelligence","9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0"],"about":{"@type":"SoftwareApplication","name":"main.gif","applicationCategory":["peexe","executable"],"identifier":"9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0","additionalType":"Malicious sample"},"threatScore":67,"malwareFamily":"Trojan.Dropper","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tc18,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAimSURBVFhHvZd5UNzlGcfxqtP2D62tra2d0VrTqR2tVm2NjtrRtIk2iUa80sYaTWKbmMYjGo3iSDQTUQgkhPvaZQ92Wdgs9wLhhoTl3GUXWG5YYIHlCOeSDdd++u6m0tQjxGP6zrwzu7M7v+/nuZ+fj88FzpOS47yckscWeQaez557of9/q7+ZhiYIyqvkaamOZxJ1bIpUsyFUzl8jVGyNTmFbgo7tsgw2JWh5LF777YIhjqFvjLCqDpLahjhqaGZfVhn/1OazRZHFZuERD5iv8IgHYH24ks1RGvZI0glILSAyu+KbAXkAarsHiNaXox+YQTcwS7JjDo24WQ4XuYMz5PeOkdHWR5zBwts5ZWxJyuEpeSaPSXTsSSvmkLZQgJz8eiAegEb7CMpCAyOzZxl2nsU+OUvn2CT1Q5OUD0ySbZ9Ca3eSMTxP/fQibTMLVNpHeS2jmPfyKwksqyVAhPBrecMD0DE8TqywbNDpYti1gMM1z8DsPH2zc3RPu+iYcNJyehqz4zQVfaMUCCjD+Bl6ZpyUd3cSUl1NcksDUfoU0Pl87q6YsMMzZwhLL6R9bMor3Ouco2vGRfvEDDZTKT2VGTScnsE4OkWNgKi1D1DSbEJvs9M+3IGhsxKVuYhkg5qR+JtYir2UJckVuNWXLMNcEMLjhaO6AowiFDYRgk5hdevgEK2h2xh4/lZGd93C1O57qOhpocLeT2V3K9WNxeS0Wslsa6fGZia8voBDdZVokvYzH/EdFiK+y2LC1bhjLwLCC5BRSGXPIB0e8fEZrKYyRnbewdSunzOx92Ym995NUsVH7Mv05ZD+JXanriWyKhhlYxfF/aOobP28XNXAq9nFuFWXsCS9THjhhyyGXi488WOvJ77UCx6AEOGBko4+rONOGkUCtkrfZGT/3Thf+RFnd/0Aa+p7xBgD+LDg7zytepAHom7j3bL3kbb0EVNrpWJ4kicKTLyQceq/OZDiw2KEAJH/9CIA0vIpsLZiGT2N2T5ITWoEWYpw9BnJtAXtILc0hrfN/ryd/wzbsjaxVb8DbbeDcEsP/qUNNIkk/aPWwNaUkmVLPVYvRYkbc/kXA3gs954+JZHpxymqK8fS04jJZuVVnZW/RdexWdnBu9nd1Az2ENMcy5N57/B62T7imk8S1dTHJ8Yu/EoaaByZ5OGkErarCr0An1bDUqCoCtWqCwCkXQX5N1Eg+xdl5Wqam/UYe9pYvTeHdQeL2Hi4mheVTfR1BmJrD8Zq09Bl2kZBZx3B5h4+qG3nzSIjzSIEa2Qn2JmUvxwCd8IluD/2lOX1nwfwWv6fml0Mv5ROzVNU5R2mrtPEQx8U8asdWfz29Tx+8YYRv4waBswbOF16HeOGGxk7+QcaGvcRaOzEz9DC3oJaGocnWJuoZ48y1/tct0Jcj/Uh5/rC/yTg+eJL0d/DJbuZDvkadBV6SkWH+82uHO588wRbpCZ+d6CRCksc9vxrmMj1YSzNh97c64lv6ce/uoW3TjbyxokqLKI/rJdm8JoiG2RCNFoAHPwC8fPj446+jLOyG1lU3YL2eAAJp2rI6R1FL7pdtm2YtM5BjncNUd5VQXvqdTgSfOhWXoW26QSHakTtG820jI0RVW2iaWiYx6XH+UgWC0eEcNiXiC8DKK5kIeYaFuNEjWqvJFiXRkR5HamdDpTtg0hb+0XS9RLeZCNBWCtttZPYYiPa3MQxQzHJdXosvSZGpkZJqiqiZaCHnTIJmVEvgvz7X1523riL+lxSXMuCpz7l50rkQGoewSU1XnGPYFRTL6EWG0GmLgLq2wgw1BFdU0q2SU+brZLxSTvzC2fEdWFsLaCrz4RvnJz35eoLT0UvQKxoEMqfsKS+YTkR/ZL1HBQTLb65j4hGG0caukWStRNQbRY7QiF55jxGRqycneyC2X6Ynwb3EizNMzs7yvBQHc9IVLwjdogL930PgOwKFnW34066ehlgt9h09otFJNzSzRFTG4drGwiuLEFt0GJt0jDdLiadTSTYuFmInhV5LMQ9AO4F5uaczDqHUdaY8FfpLwIgXkyrnNWiRwsPpFx2LgQxB9ifrCbekI+yVEKW3o+m4jeYqPIDy8dgF+KzdmG5EyZbYKIZ96IL55lxTlkKGBzr50hpFR+q8y4CQC1KRP0z3CWPQ9qvIfkaHIk3UKN4hJ709Thyn8RZ9YrYVN6D3kSYqgZnBzjKWbTGMNYkoburmPEpB5n1J3grVYlFtO+/CC8GaFYAWK6CJDEmU3+Ju3g97srNuE27oVlYazsCo0lCLFm0aCHek4DLHMRg9UEaKg6RVRZOUPYxYk7lYhmysycznZ0p6ZgHRtgoAAI1+SuvZstbi1JASD0ls4qFrNWM6h9nLM+XwawNdGc/gTVnK6fSn0ee5c8BXTAvJMewSSkRHS+RbWlZhFbViO8adqh1mOwOfMXy6h+n8QB8BQhPUoqQGI9dS1DUK4RpPyBQ9zF+unD2aON5XiPDV6XkUYWKhxKTuF+i4L64RB6Il3BvTDzrE+XsUGkx9jt4VpbOP/wDPwVYGeL8rij7ZBXPHY4UD1HxbHIavpo0NooHr1Ok8HCimgelSq/wPUL095HR3BURJW4kjyYk8KJCTX3/EM8pMrl/g+/5ABcH4QURp2tgiPTKevYqdKyXKFkTJ+NPUgVrJHJhcSKro2K9wreHhXFb6FHuDA1lXVw02+Uq6vqGxNT09oCv5oHPNg0PyMT0DJ32IfGuUMI7qRlsEO5eFxfPn+PiuC8ynLuOHeXWkEDuOBLE2qhwtkrl5wDk6d9M/HwYD4hrbo72/gGqrR3E55cSkJvPs4kSHomO4IGwEO4NPczaiKO8IJF5AbZHJ397AJ/1jNPlor61A73BiKaiipCiQnaIingw5BBbE2Scarex8aVXL64CVnxRWOEP41PTFNUYkeWWcUJMx0wxltW5xf8f8c+ydfT2I0v39v8VM/7fOuoE7dlb0mQAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":67,"unified_at_epoch_ms":1791400646186,"unified_at":"2026-10-07T19:17:26.186Z","metadata":{"hashes":{"sha256":"9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0","sha1":"88ea404f90dc909bf8f587003cfbdfd2af920fc8","md5":"62fdf4822431d4c82b78e602ab3558ad","sha512":"6657c98ebab6c463a919fc4e0a81d67f9f0c9e1b96fcc0dbbc24d30d9c74e5aaafc53a867a9ef8cf2d0144d548fdaf37503f359e00c8bfe2c696ffc75e39ae12","ssdeep":"1536:VNoceSeJ0xgP5BgC6Vdv90Dw4WXJrLDc0Rz/gyzRZICrWaGZh7:vRe465BgCuVG81U0Rz4CJrWNZ","ssdeep_chunks":["1536:VNoceSe","1536:NoceSeJ","1536:oceSeJ0","1536:ceSeJ0x","1536:eSeJ0xg","1536:SeJ0xgP","1536:eJ0xgP5","1536:J0xgP5B","1536:0xgP5Bg","1536:xgP5BgC","1536:gP5BgC6","1536:P5BgC6V","1536:5BgC6Vd","1536:BgC6Vdv","1536:gC6Vdv9","1536:C6Vdv90","1536:6Vdv90D","1536:Vdv90Dw","1536:dv90Dw4","1536:v90Dw4W","1536:90Dw4WX","1536:0Dw4WXJ","1536:Dw4WXJr","1536:w4WXJrL","1536:4WXJrLD","1536:WXJrLDc","1536:XJrLDc0","1536:JrLDc0R","1536:rLDc0Rz","1536:LDc0Rz/","1536:Dc0Rz/g","1536:c0Rz/gy","1536:0Rz/gyz","1536:Rz/gyzR","1536:z/gyzRZ","1536:/gyzRZI","1536:gyzRZIC","1536:yzRZICr","1536:zRZICrW","1536:RZICrWa","1536:ZICrWaG","1536:ICrWaGZ","1536:CrWaGZh","1536:rWaGZh7","3072:VNoceSe","3072:NoceSeJ","3072:oceSeJ0","3072:ceSeJ0x","3072:eSeJ0xg","3072:SeJ0xgP","3072:eJ0xgP5","3072:J0xgP5B","3072:0xgP5Bg","3072:xgP5BgC","3072:gP5BgC6","3072:P5BgC6V","3072:5BgC6Vd","3072:BgC6Vdv","3072:gC6Vdv9","3072:C6Vdv90","3072:6Vdv90D","3072:Vdv90Dw","3072:dv90Dw4","3072:v90Dw4W","3072:90Dw4WX","3072:0Dw4WXJ","3072:Dw4WXJr","3072:w4WXJrL","3072:4WXJrLD","3072:WXJrLDc","3072:XJrLDc0","3072:JrLDc0R","3072:rLDc0Rz","3072:LDc0Rz/","3072:Dc0Rz/g","3072:c0Rz/gy","3072:0Rz/gyz","3072:Rz/gyzR","3072:z/gyzRZ","3072:/gyzRZI","3072:gyzRZIC","3072:yzRZICr","3072:zRZICrW","3072:RZICrWa","3072:ZICrWaG","3072:ICrWaGZ","3072:CrWaGZh","3072:rWaGZh7","1536:vRe465B","1536:Re465Bg","1536:e465BgC","1536:465BgCu","1536:65BgCuV","1536:5BgCuVG","1536:BgCuVG8","1536:gCuVG81","1536:CuVG81U","1536:uVG81U0","1536:VG81U0R","1536:G81U0Rz","1536:81U0Rz4","1536:1U0Rz4C","1536:U0Rz4CJ","1536:0Rz4CJr","1536:Rz4CJrW","1536:z4CJrWN","1536:4CJrWNZ"],"imphash":"b51551b7cdf439cbb87df6c285bec8f0"},"file_info":{"file_name":"main.gif","file_type":["peexe","executable"],"file_type_id":"exe","file_size":95744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296881000,"last_seen":1624426679000,"last_multi_scan":1624426679000}},"detections":{"summary":{"verdict":"malicious","score":67,"tags":null},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":16,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Rifdoor.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1119671","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.Dropper.XUG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Dropper.XUG (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.UDW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Gamarue.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0000000c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericR-FNU!62FDF4822431","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.dzilst","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Agent-ARR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Backdoor.Trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DownLoader18.BBWO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.BrowseFox.Win32.275728","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Dropper","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00130906-00002284-4580-161-009B350B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00130906-00002284-4580-223-009B7CEF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00130906-00002284-9463-161-009B350B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00130906-00002284-9463-223-009B7CEF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00134000-00002344-13582-161-00A7350B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00134000-00002344-13582-223-00A77CEF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00134000-00002344-16893-161-00A7350B\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00134000-00002344-16893-223-00A77CEF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"175.117.144.67:556\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\Data\\My Projects\\Troy Source Code\\tcp1st\\rifle\\Release\\rifle.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 76DA0000\n \"\" loaded module \"OLE32.DLL\" at base 769D0000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 74F80000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\UXTHEME.DLL\" at base 73DB0000\n \"\" loaded module \"PROPSYS.DLL\" at base 73DF0000\n \"\" loaded module \"COMCTL32.DLL\" at base 73EF0000\n \"\" loaded module \"OLEAUT32.DLL\" at base 75380000\n \"\" loaded module \"ADVAPI32.DLL\" at base 76C60000\n \"\" loaded module \"SHELL32.DLL\" at base 75B30000\n \"\" loaded module \"CLBCATQ.DLL\" at base 759C0000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\PROPSYS.DLL\" at base 73DF0000\n \"\" loaded module \"NTMARTA.DLL\" at base 745C0000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 77040000\n \"\" loaded module \"PROFAPI.DLL\" at base 75030000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"SystemFunction036@CRYPTBASE.dll\"\n \"PSCreateMemoryPropertyStore@PROPSYS.dll\"\n \"PSPropertyBag_WriteDWORD@PROPSYS.dll\"\n \"PSPropertyBag_ReadDWORD@PROPSYS.dll\"\n \"RegEnumKeyW@ADVAPI32.dll\"\n \"PSPropertyBag_ReadBSTR@PROPSYS.dll\"\n \"PSPropertyBag_ReadStrAlloc@PROPSYS.dll\"\n \"OpenThreadToken@ADVAPI32.dll\"\n \"GetCatalogObject@CLBCatQ.DLL\"\n \"GetCatalogObject2@CLBCatQ.DLL\"\n \"DllGetClassObject@PROPSYS.dll\"\n \"DllCanUnloadNow@PROPSYS.dll\"\n \"InitializeSecurityDescriptor@ADVAPI32.dll\"\n \"SetEntriesInAclW@ADVAPI32.dll\"\n \"GetMartaExtensionInterface@ntmarta.dll\"\n \"SetSecurityDescriptorDacl@ADVAPI32.dll\"\n \"IsTextUnicode@ADVAPI32.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegGetValueW@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c del /q \"Z:\\main.gif.exe\" >> NUL\" on 2015-12-22.01:23:49","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"guifx.exe\" with commandline \"/run\" (UID: 00134000-00002344)\n Spawned process \"cmd.exe\" with commandline \"/c del /q \"Z:\\main.gif.exe\" >> NUL\" (UID: 00178109-00002660)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00130906-00002284-76F4228D-174968\n LookupAccountNameLocalW@SECHOST.DLL at 00130906-00002284-76F4228D-177548\n GetUserNameA@ADVAPI32.DLL at 00130906-00002284-4580-166-009B1980\n GetUserNameA@ADVAPI32.DLL at 00130906-00002284-9463-166-009B1980\n GetUserNameA@ADVAPI32.DLL at 00134000-00002344-13582-166-00A71980\n GetUserNameA@ADVAPI32.DLL at 00134000-00002344-16893-166-00A71980","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"guifx.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00130906-00002284-4580-33-009B4697\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00130906-00002284-4580-12-009B2CA2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00130906-00002284-4580-400-009B72E8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00130906-00002284-9463-12-009B2CA2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00130906-00002284-9463-33-009B4697\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00130906-00002284-9463-400-009B72E8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00134000-00002344-13582-33-00A74697\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00134000-00002344-13582-12-00A72CA2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00134000-00002344-13582-400-00A772E8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00134000-00002344-16893-33-00A74697\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00134000-00002344-16893-12-00A72CA2\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00134000-00002344-16893-400-00A772E8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"guifx.exe\" sleeping for \"00180000\" milliseconds\n \"guifx.exe\" sleeping for \"10800000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db\"\n \"\" created file \"C:\\windows\\system32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"guifx.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"GRAPHICS\", Value: \"\"C:\\ProgramData\\Graphics\\guifx.exe\" /run\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"175.117.144.67\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetEntriesInAclW@ADVAPI32.DLL at 00130906-00002284-76F4228D-170704\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00130906-00002284-76F4228D-170781","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 149956 does not match actual CRC 148308","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"closesocket (Ordinal #3)\n connect (Ordinal #4)\n WSAStartup (Ordinal #115)\n recv (Ordinal #16)\n socket (Ordinal #23)\n send (Ordinal #19)\n RegCloseKey\n RegOpenKeyA\n GetUserNameA\n RegOpenKeyExA\n ShellExecuteA\n CreateFileW\n LoadLibraryW\n GetStartupInfoW\n GetComputerNameA\n CreateFileA\n GetFileSize\n GetTickCount\n WriteFile\n GetCommandLineA\n Sleep\n CreateProcessA\n TerminateProcess\n CreateDirectoryA\n LoadLibraryA\n GetModuleFileNameA\n GetVersionExA\n WinExec\n GetTempPathA\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/54 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"cmd.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 95744 bytes starting with PE header signature to file \"C:\\ProgramData\\Graphics\\guifx.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"guifx.exe\" (PID: 00002344)\n \"\" wrote 52 bytes to a foreign process \"guifx.exe\" (PID: 00002344)\n \"\" wrote 4 bytes to a foreign process \"guifx.exe\" (PID: 00002344)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"567914d90e316d1c3bcb3907","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":67,"malware_family":"BehavesLike.FakeAlertWinwebSecurity","contacted_countries":["KOR"],"submit_name":"main.gif","analysis_start_time":"2015-12-22T03:16:25+00:00","indicators_count":{"informative":11,"suspicious":17,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"175.117.144.67","port":556,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}],"processes":[{"pid":2284,"ppid":0,"name":"main.gif.exe","command_line":"","normalized_path":"","uid":"00130906-00002284","icon":"$25"},{"pid":2344,"ppid":0,"name":"guifx.exe","command_line":"/run","normalized_path":"","uid":"00134000-00002344"},{"pid":2660,"ppid":0,"name":"cmd.exe","command_line":"/c del /q \"Z:\\main.gif.exe\" >> NUL","normalized_path":"","uid":"00178109-00002660"}],"all_imported_dlls":["PROPSYS.dll","comctl32.dll","wkscli.dll","mswsock.dll","DNSAPI.dll","MSCTF.dll","wshtcpip.dll","msvcrt.dll","SHELL32.dll","CFGMGR32.dll","SETUPAPI.dll","SHLWAPI.dll","MSASN1.dll","apphelp.dll","CLBCatQ.DLL","WINBRAND.dll","CRYPT32.dll","cscapi.dll","napinsp.dll","NLAapi.dll","iertutil.dll","PSAPI.DLL","WININET.dll","ntlanman.dll","NSI.dll","ntmarta.dll","drprov.dll","ADVAPI32.dll","KERNELBASE.dll","DEVOBJ.dll","netutils.dll","WS2_32.dll","SspiCli.dll","USER32.dll","LPK.dll","VERSION.dll","uxtheme.dll","winrnr.dll","kernel32.dll","urlmon.dll","GDI32.dll","WINNSI.DLL","fwpuclnt.dll","USP10.dll","IMM32.DLL","profapi.dll","pnrpnsp.dll","rasadhlp.dll","IPHLPAPI.DLL","MPR.dll","davclnt.dll","ntdll.dll","ole32.dll","RPCRT4.dll","sechost.dll","OLEAUT32.dll","CRYPTBASE.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"guifx.exe","sha256":"3b1112a170336fe0c72791f727fe7798a6d32528af67a648ad55c8f9280c0767","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Graphics","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%SAMPLEDIR%\\main.gif.exe","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%ALLUSERSPROFILE%\\Graphics\\guifx.exe","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"path":"NUL","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"567914d90e316d1c3bcb3907"}]}]}},"report_ids":{"sandbox_job_ids":["567914d90e316d1c3bcb3907"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Dropper Sample 9a44ef502f2a… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9a44ef502f2a…. Malware family: Trojan.Dropper. Threat score 67/100. 18/28 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Dropper Sample 9a44ef502f2a… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9a44ef502f2a…. Malware family: Trojan.Dropper. Threat score 67/100. 18/28 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9a44ef502f2a7d666d7b7ac9cfd5cb104ca494e4eb2e21068b8bd2c693d93bf0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Dropper Sample 9a44ef502f2a… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9a44ef502f2a…. Malware family: Trojan.Dropper. Threat score 67/100. 18/28 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]